# Refuse to resolve any package version published less than 7 days ago.
#
# The npm counterpart of `[tool.uv] exclude-newer = "7 days"` in
# pyproject.toml, and the same 7 days as dependabot's `cooldown` in
# .github/dependabot.yml -- one policy across every dependency manager in this
# repo, not three different numbers. A release published minutes ago is the
# likeliest to be a compromised one, and the window between a malicious publish
# and its takedown is typically hours, so declining to install anything from
# this week removes most of that exposure at almost no cost.
#
# What this does and does not cover:
#   * `npm install` / `npm update` here -- covered, this is the moment a
#     version is actually chosen.
#   * `npm ci` (what CI runs) -- unaffected by design. It installs exactly what
#     package-lock.json already pins, so there is nothing to hold back.
#   * automated bumps -- covered separately by dependabot's cooldown.
#
# Requires npm >= 11.10.0, which is where `min-release-age` landed. Older npm
# prints `npm warn Unknown project config "min-release-age"` and then resolves
# versions with no cooldown at all -- verified against npm 11.9.0. So the
# setting is not silent, but it IS inert: treat that warning as "this
# protection is off", not as noise. package.json's `engines.npm` is the other
# half of making that visible.
#
# CI runs `npm ci` on Node 22 (npm 10.x), which predates the setting. That is
# fine -- `npm ci` installs the pinned lockfile and has nothing to hold back --
# but it does mean CI is not where this control is enforced.
#
# Per-directory on purpose: npm reads .npmrc from the current working
# directory and does not walk up to parents, so one file at the repo root
# would not cover these packages.
min-release-age=7
